Vulnerability in Kernel (CVE-2023-52894)

Summary

Vulnerability in Kernel (CVE-2023-52894). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8 or later.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()

In Google internal bug 265639009 we've received an (as yet) unreproducible
crash report from an aarch64 GKI 5.10.149-android13 running device.

AFAICT the source code is at:
https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10

The call stack is:
ncm_close() -> ncm_notify() -> ncm_do_notify()
with the crash at:
ncm_do_notify+0x98/0x270
Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)

Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):

// halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
0B 0D 00 79 strh w11, [x8, #6]

// word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
6C 0A 00 B9 str w12, [x19, #8]

// x10 (NULL) was read here from offset 0 of valid pointer x9
// IMHO we're reading 'cdev->gadget' and getting NULL
// gadget is indeed at offset 0 of struct usb_composite_dev
2A 01 40 F9 ldr x10, [x9]

// loading req->buf pointer, which is at offset 0 of struct usb_request
69 02 40 F9 ldr x9, [x19]

// x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
4B 5D 40 B9 ldr w11, [x10, #0x5c]

which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:

event->wLength = cpu_to_le16(8);
req->length =…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2023-52894 has been found in Kernel.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Kernel to 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8 or later.
If unsure, ask your IT team or search "Kernel CVE-2023-52894" on the vendor's site.

CVE-2023-52894 (Kernel)
Patched: 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (unclassified) exists in Kernel.

📍 Affected scope

Check the vendor advisory for the affected versions of Kernel.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Kernel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'Kernel' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Kernel を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade Kernel to 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8
```
ステージング環境で 4.14.304, 4.19.271, 5.4.230, 5.10.165, 5.15.90, 6.1.8 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.14.304"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.19.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.230"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.165"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.90"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.8"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-52894 linux Fixed in: 5.10.178-1
Ubuntu UBUNTU-CVE-2023-52894 linux-azure Fixed in: 4.15.0-1163.178~14.04.1